GitOps at scale for dozens of AI microservices

The challenge

Running dozens of AI microservices across development, staging and production is complex. Without a single source of truth, deployments drift, secrets leak into places they should not be, and nobody can say with confidence what is actually running in production.

What we built

The configuration backbone for the whole portfolio, managed with Flux CD. Every deployment is declared as code in Git, and when a pull request is merged Flux reconciles the cluster to match, with no manual kubectl apply and no configuration drift.

• Base and overlay structure: shared Helm chart definitions live in a base directory, and environment-specific differences (images, resource limits, secrets and environment variables) are applied as Kustomize patches per cluster.
• Secrets handled safely: all secrets flow from Azure Key Vault through the Kubernetes CSI Secrets Store driver, using managed identity. They are never stored in Git and never baked into images.
• Production guardrails: any pull request that touches the production directory must reference a change record in its title.
• One consistent pattern for a portfolio that spans conversation intelligence, document automation, AI agents, workflow automation and executive tooling, including services built on Temporal workflows.

Results

• Repeatable, reviewable deployments across every environment.
• No configuration drift between what is declared and what runs.
• Secrets kept out of source control and images.
• Change control built into the pull-request workflow.